Cookie policy and consent: the practical version
What the rules require before a website stores cookies or similar identifiers, what a compliant banner looks like, and how to need less consent.
The short answer
European rules require consent before a website stores information on a visitor’s device or reads information from it, unless that storage is strictly necessary for a service the visitor asked for. That covers cookies and equivalent techniques such as local storage identifiers and tracking pixels. Strictly necessary means the login session, the basket, load balancing and the record of the consent choice itself. Analytics, advertising, personalisation, testing and third-party embeds that set identifiers all need consent first. Valid consent is freely given, specific, informed and unambiguous, and given by a clear affirmative action, which rules out pre-ticked boxes, implied consent from continued browsing, and designs where accepting is easier than refusing. Supervisory authorities have acted on exactly those designs. The cheapest route to compliance is to need less consent: cookieless analytics, self-hosted fonts and scripts, and embeds that load only when clicked can remove the banner entirely, which is both compliant and better for visitors.
What needs consent and what does not
| Purpose | Consent needed? | Notes |
|---|---|---|
| Login session, basket, checkout state | No | Strictly necessary for a requested service |
| Remembering the consent choice | No | Necessary to honour the choice |
| Load balancing and security | No, where genuinely necessary | Document the necessity |
| Analytics with identifiers | Yes | Cookieless aggregate analytics can avoid it |
| Advertising and retargeting | Yes | Including pixels that set identifiers |
| Personalisation and recommendations | Yes | Beyond what the visitor asked for |
| A/B testing with identifiers | Yes | Server-side or cookieless approaches may not need it |
| Third-party video, maps, social embeds | Usually yes | Click-to-load with a placeholder avoids it |
| Chat widgets | Usually yes | Load on interaction |
Making a banner compliant
- Scan the site in a private window before touching the banner, and list everything set or loaded. That is your real cookie inventory.
- Block non-essential scripts until consent is given, and verify in the browser that they actually wait.
- Design the first layer with accept and reject equally prominent, plus a link to per-purpose settings.
- Describe purposes in plain terms, not vendor names alone.
- Record consent: what was given, when, for which purposes, and keep it.
- Make withdrawal easy: a permanent link in the footer, honoured immediately.
- Re-ask only when purposes change, not on every visit.
- Publish the cookie policy listing the actual cookies, their purposes, setters and lifetimes.
- Re-scan after every change to tags or embeds.
The alternative worth considering
A business site can be built so that nothing non-essential is stored at all: cookieless analytics that count without identifying, fonts and scripts served from your own domain, videos and maps that load on click. The banner then disappears, the privacy statement gets shorter and more honest, the pages get faster, and there is no consent mechanism to maintain or get wrong. For a small business website this is achievable and is the option we recommend.
What this means for you
Consent is required before anything non-essential is stored on a visitor’s device, must be as easy to refuse as to give, and must actually control the scripts. Inventory what your site really sets, block non-essential scripts until consent, design an honest banner, record and honour choices, and publish an accurate cookie policy. Better still, remove the need: cookieless analytics, self-hosted resources and click-to-load embeds let a business site drop the banner altogether. This is general information rather than legal advice.
Frequently asked questions
Which cookies do not need consent?
Those strictly necessary to provide the service the visitor asked for: the session that keeps someone logged in, the shopping basket, a load balancing cookie, and the cookie that remembers their consent choice. Analytics, advertising, personalisation, A/B testing and third-party embeds that set identifiers are not strictly necessary, however useful they are to the business.
Is a banner with only an accept button allowed?
No. Consent must be as easy to refuse as to accept, which in practice means an equally prominent reject option at the first layer. Dutch and other European supervisory authorities have been explicit about this, and designs where refusing takes extra clicks or hidden settings have been found non-compliant. The same applies to cookie walls that make access conditional on accepting tracking.
What must the cookie policy itself contain?
What cookies and similar technologies the site uses, grouped by purpose, who sets them, what they do, how long they last, and how to change or withdraw consent. Keeping it accurate means keeping a list of the site's actual cookies, which is also the only way to know whether the banner controls them. A scan of the site before and after consent gives you that list.
Sources
- Autoriteit Persoonsgegevens: Cookies (accessed 2026-09-12)
- European Data Protection Board: Guidelines 05/2020 on consent (accessed 2026-09-12)